** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| D-link |
|
No data.
No data.
References
No reference.
History
Tue, 03 Nov 2026 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-77 | |
| CPEs | cpe:2.3:o:dlink:dir-878_firmware:1.01b04:*:*:*:*:*:*:* |
|
| Vendors & Products |
Dlink
Dlink dir-878 Dlink dir-878 Firmware |
|
| References |
|
|
| Metrics |
cvssV3_1
|
Tue, 03 Nov 2026 19:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetNetworkSettings' functionality of prog.cgi, where the 'IPAddress' and 'SubnetMask' parameters are directly concatenated into shell commands executed via system(). An attacker can exploit this vulnerability remotely without authentication by sending a specially crafted HTTP request, leading to arbitrary command execution on the device. NOTE: this is disputed by third parties because /cgi-bin/prog.cgi does not exist and because "directly concatenated into shell commands" occurs after adequate input vaidation. | ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. |
Tue, 03 Nov 2026 19:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetNetworkSettings' functionality of prog.cgi, where the 'IPAddress' and 'SubnetMask' parameters are directly concatenated into shell commands executed via system(). An attacker can exploit this vulnerability remotely without authentication by sending a specially crafted HTTP request, leading to arbitrary command execution on the device. | An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetNetworkSettings' functionality of prog.cgi, where the 'IPAddress' and 'SubnetMask' parameters are directly concatenated into shell commands executed via system(). An attacker can exploit this vulnerability remotely without authentication by sending a specially crafted HTTP request, leading to arbitrary command execution on the device. NOTE: this is disputed by third parties because /cgi-bin/prog.cgi does not exist and because "directly concatenated into shell commands" occurs after adequate input vaidation. |
Mon, 17 Nov 2025 18:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Dlink
Dlink dir-878 Dlink dir-878 Firmware |
|
| CPEs | cpe:2.3:h:dlink:dir-878:a1:*:*:*:*:*:*:* cpe:2.3:o:dlink:dir-878_firmware:1.01b04:*:*:*:*:*:*:* |
|
| Vendors & Products |
Dlink
Dlink dir-878 Dlink dir-878 Firmware |
Fri, 14 Nov 2025 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-77 | |
| Metrics |
cvssV3_1
|
Fri, 14 Nov 2025 09:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
D-link
D-link dir-878 D-link dir-878 Firmware |
|
| Vendors & Products |
D-link
D-link dir-878 D-link dir-878 Firmware |
Thu, 13 Nov 2025 19:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetNetworkSettings' functionality of prog.cgi, where the 'IPAddress' and 'SubnetMask' parameters are directly concatenated into shell commands executed via system(). An attacker can exploit this vulnerability remotely without authentication by sending a specially crafted HTTP request, leading to arbitrary command execution on the device. | |
| References |
|
MITRE
Status: REJECTED
Assigner: mitre
Published: 2025-11-13T00:00:00.000Z
Updated: 2026-11-03T19:16:56.608Z
Reserved: 2025-09-26T00:00:00.000Z
Link: CVE-2025-60676
Vulnrichment
Updated:
NVD
Status : Rejected
Published: 2025-11-13T19:15:48.560
Modified: 2026-11-03T20:17:39.693
Link: CVE-2025-60676
Redhat
No data.